@bsv/wallet-toolbox and related client packages suffer from improper validation of consistency within input (CWE-1288). Specifically, transactions created via a remote StorageClient trust output locking scripts returned by the storage provider without verifying they match the requested outputs. This allows a malicious or compromised storage provider to substitute recipient scripts or add outputs, causing unauthorized fund redirection while the UI shows the expected recipient. The vulnerability affects stable versions >=1.1.47 <2.4.0 for @bsv/wallet-toolbox and @bsv/wallet-toolbox-client, and >=1.3.21 <2.4.0 for @bsv/wallet-toolbox-mobile. The issue is patched in version 2.4.0.

An attacker controlling or compromising the remote storage provider can cause the wallet to sign and broadcast transactions that redirect funds to unintended recipients without the user's knowledge. This leads to potential financial loss as the user interface continues to display the intended recipient, misleading users into approving malicious transactions.

A fix is available in version 2.4.0 of all affected packages. Users should upgrade to this version to remediate the vulnerability. Applications unable to upgrade should avoid using remote StorageClient providers, use local storage instead, or independently verify every transaction output's locking script and value against the original request before signing to prevent unauthorized fund redirection.